
In Section , by studying the form of adversarial risk, we figure out the minimax lower bound of estimation error, which reveals the potential to improve the estimation efficiency through using model information.

In Section , we design a two-stage adversarially robust learning framework that nicely connects adversarially robust estimation with standard estimation. The model structure information can be easily embedded into the standard estimator, and is further carried over to the adversarially robust estimate through this two-stage learning procedure. For the purpose of statistical inference, we develop the Bahadur representation result [1]} that implies the asymptotic normality of the proposed estimate under certain conditions. In addition, by analyzing the upper bound for the estimation error, we reveal the benefit of incorporating sparsity information into the adversarial estimation procedure, in which the estimator reaches the minimax optimal rate of convergence.

Besides the above two main contributions, in Section , we utilize our theory to verify two arguments in adversarially robust learning: adversarially robust learning hurts generalization, and adversarial robustness can be improved using unlabeled data.

